aml-trustlab[.]com

Analysis of aml-trustlab.com indicates a high-risk phishing domain targeting cryptocurrency users through wallet and seed phishing tactics. The domain, registered on November 7, 2025, via NameSilo, LLC, was flagged by multiple security vendors and blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, which classified it as a wallet/seed phishing threat. Infrastructure analysis reveals the domain resolved to IP 45.151.91.28, hosted under AS209101 (IP Vendetta Inc.) in Germany, a network frequently associated with malicious activity. The domain's nameservers (ns1.dnsowl.com, ns2.dnsowl.com, ns3.dnsowl.com) are consistent with bulletproof hosting providers, further suggesting its use in phishing operations.

The page title, 'AML Bot — Fast & Secure AML Verification,' implies an attempt to impersonate a legitimate anti-money laundering verification service, though the exact content and functionality of the site remain unconfirmed due to its current offline status. Google Safe Browsing flagged the domain for social engineering, aligning with its classification as a brand impersonation threat targeting 'foundation.' No SSL certificate was detected, increasing the likelihood of interception or tampering during user interactions. The domain appears on four security blocklists, and Gridinsoft assigned it a trust score of 0/100, reinforcing its malicious classification.

Defenders should treat this domain as compromised and prioritize blocking it at the DNS and network levels. Given its association with wallet/seed phishing, organizations handling cryptocurrency transactions should alert users to avoid interaction with any related URLs or communications. The domain's current HTTP 200 status suggests it may have been temporarily disabled rather than fully decommissioned, warranting continued monitoring for reactivation or migration to new infrastructure.